Tags: jwcarman/who

feat: auto-revoke pending enrollment tokens on re-issue and record re…

…deemedAt timestamp

- createToken() now revokes any existing PENDING tokens for the identity before
  issuing a new one, preventing multiple live tokens per identity
- EnrollmentToken gains a redeemedAt field (nullable) recorded when the token
  is redeemed, providing an audit trail of when enrollment occurred

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

refactor: extract private helpers in RbacService to avoid this-call w…

…arning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test: verify @RequiresPermission works end-to-end with Spring Security

Add spring-security-test dependency and integration test confirming
that @RequiresPermission enforces hasAuthority checks via method security.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test: add coverage for WhoException message formatting

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test: use method reference and extract tokenValue local variable

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: update README to document WhoService.createIdentity() as the id…

…entity API entry point [skip ci]

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

refactor: extract authority-building into private method in WhoAuthen…

…ticationToken

Improves readability by separating the null-check + authority extraction
from the super() call.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

refactor: enforce value objects throughout RBAC and enrollment APIs

- Role.create(String name) now generates its own UUID internally
- RbacService methods all accept/return Role instead of UUID
- EnrollmentToken.create(Identity, Duration) replaces (UUID, int)
- WhoEnrollmentService.revokeToken(EnrollmentToken) replaces (UUID)
- WhoProperties.Enrollment uses Duration for token expiration
- README updated to reflect all API changes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: exclude who-example using -pl flag in release workflow

The previous approach of overriding modules in the release profile
doesn't work in Maven. Instead, use the -pl flag with exclusion syntax
to explicitly exclude who-example from the release build.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

fix: exclude who-example using -pl flag in release workflow

The previous approach of overriding modules in the release profile
doesn't work in Maven. Instead, use the -pl flag with exclusion syntax
to explicitly exclude who-example from the release build.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>